A quantum secure communication method and system for blockchain network

Abstract

The present invention relates to the field of quantum security and blockchain, and in particular to a quantum security communication method and system for a blockchain network. The blockchain network has a first computing device and a second computing device connected to each other; a first key pair generated based on a post-quantum encryption algorithm and a second key pair generated based on a traditional encryption algorithm are stored in a key library of a first quantum security service layer deployed on the first computing device. The method includes: when the first computing device initiates a target transaction to the second computing device, the target transaction is signed by a quantum encryption algorithm and a traditional encryption algorithm using the private key of the first key pair and the private key of the second key pair, respectively. The second computing device receives the target transaction and signature data, and uses the public key of the first key pair and the public key of the second key pair to verify the corresponding signature data. If there is a signature verification failure, the target transaction is rejected.

Description

Technical Field

[0001] The present invention relates to the fields of quantum security and blockchain, and in particular to a quantum security communication method and system for a blockchain network. Background Art

[0002] With the rapid development of quantum computing technology, the potential threat it poses to modern cryptographic systems has become an important focus of research in the field of information security. In particular, the powerful computing power of quantum computers will be able to solve large integer factorization and discrete logarithm problems in polynomial time, making the currently widely used public key encryption algorithms, such as RSA (Rivest-Shamir-Adleman), ECDSA (Elliptic Curve Digital Signature Algorithm) and ECDH (Elliptic Curve Diffie-Hellman), no longer secure.

[0003] The security of these public key encryption algorithms is based on the fact that the integer decomposition problem (also known as the prime factorization problem) that the public key encryption algorithms rely on is not computable under the classical computing model. However, the Shor algorithm shows that quantum computers can solve this mathematical problem in a feasible time, thus threatening the security of the public key encryption algorithms constructed based on this mathematical problem.

[0004] Blockchain technology, as a revolutionary distributed ledger technology, relies heavily on these traditional encryption algorithms for its security and integrity. The immutability and decentralization of blockchain, especially in the context of cryptocurrency and smart contracts, require extremely high security standards. Therefore, the threat posed by quantum computing to traditional encryption algorithms will directly affect the security foundation of blockchain systems.

[0005] In view of this, the present invention proposes a quantum secure communication method and system for blockchain networks, so that through the technical solution proposed by the present invention, the blockchain network can seamlessly access post-quantum security services without large-scale transformation of the existing network architecture. In this way, not only the blockchain network is protected from the threat of quantum attacks, but also it is fully prepared to adapt to possible technological advances in the future. Summary of the invention

[0006] One or more embodiments of this specification describe a quantum secure communication method and system for blockchain networks. By designing a quantum secure service layer and using post-quantum cryptography algorithms, a quantum secure key negotiation mechanism is provided for communication in blockchain networks. At the same time, an API decoupling layer is also designed, which acts as a middleware to expose the functions provided by the quantum secure service layer to blockchain nodes and client terminals in the form of APIs, decoupling the device from the quantum service, so that quantum secure communication can be carried out without large-scale transformation of the existing blockchain network.

[0007] According to a first aspect, a quantum secure communication method for a blockchain network is provided, wherein the blockchain network has a first computing device and a second computing device connected to each other, on which an API decoupling layer and a quantum secure service layer are deployed; a key library of the first quantum secure service layer deployed on the first computing device stores a first key pair generated based on a post-quantum encryption algorithm and a second key pair generated based on a traditional encryption algorithm; the method comprises:

[0008] The first computing device sends a signature request to the first quantum security service layer by calling the signature service interface of the first API decoupling layer deployed thereon, and the signature request includes a target transaction.

[0009] In response to the signature request, the first quantum security service layer uses the first private key of the first key pair and the second private key of the second key pair to sign the target transaction, respectively, to obtain a first signature under a post-quantum encryption algorithm and a second signature under a traditional encryption algorithm.

[0010] The first computing device sends the target transaction and signature data including the first signature and the second signature to the second computing device.

[0011] The second computing device receives the target transaction and signature data, and by calling the certificate management interface of the second API decoupling layer deployed thereon, enables the second quantum security service layer deployed thereon to obtain the first public key of the first key pair and the second public key of the second key pair.

[0012] The second computing device calls the signature verification service interface of the second API decoupling layer and sends a signature verification request to the second quantum security service layer, where the signature verification request includes the signature data.

[0013] In response to the signature verification request, the second quantum security service layer uses the first public key and the second public key respectively to verify the first signature and the second signature in the signature data, and if there is a signature verification failure, notifies the second computing device to reject the target transaction.

[0014] According to one embodiment, the blockchain network is a Hyperledger Fabric network; the method further comprises:

[0015] When the first computing device is started, the certificate management interface of the first API decoupling layer is called, and a certificate application is made to a certificate authority CA server through the first quantum security service layer, where the certificate application includes the first public key and the second public key;

[0016] The first quantum security service layer stores a first certificate generated by the CA server based on the first public key and a second certificate generated based on the second public key;

[0017] And, the second quantum security service layer obtains the first public key of the first key pair and the second public key of the second key pair, specifically including:

[0018] The second quantum security service layer obtains the first certificate and the second certificate from the first quantum security service layer;

[0019] The second computing device calls the certificate verification interface of the second API decoupling layer, and performs certificate verification on the first certificate and the second certificate through the second quantum security service layer;

[0020] If the certificate verification succeeds, the second quantum security service layer extracts the public key in the certificate to obtain the first public key and the second public key.

[0021] According to one embodiment, the blockchain network is a permissionless blockchain network; the method further comprises:

[0022] When the first computing device is started, the certificate management interface of the first API decoupling layer is called, and a public key is registered with the blockchain in the blockchain network through the first quantum security service layer, where the public key registration includes the first public key and the second public key;

[0023] And, the second quantum security service layer obtains the first public key of the first key pair and the second public key of the second key pair, specifically including:

[0024] The second quantum security service layer obtains the first public key and the second public key from the blockchain.

[0025] According to one embodiment, the method further comprises:

[0026] Before the first computing device sends the target transaction to the second computing device, the first computing device calls the key acquisition interface of the first API decoupling layer to obtain a pre-negotiated target symmetric key package, which includes a target symmetric key and a target symmetric key identifier, and the first computing device sends the target symmetric key identifier to the second computing device;

[0027] The second computing device receives the target symmetric key identifier, and accordingly calls the key acquisition interface of the second API decoupling layer to obtain the target symmetric key;

[0028] The first computing device and the second computing device communicate based on a security protocol using the target symmetric key as a pre-shared key.

[0029] According to one embodiment, the target symmetric key package is obtained by the following steps:

[0030] The first computing device calls the key negotiation interface of the first API decoupling layer, and negotiates with the second quantum security service layer through the first quantum security service layer based on the post-quantum security protocol to obtain a quantum-secure target symmetric key package.

[0031] According to one embodiment, the security protocol is the TLS protocol; the post-quantum security protocol is the Noise protocol based on the KEM mechanism using a dual public-private key pair scheme.

[0032] According to one embodiment, the long-term public key used in the KEM mechanism is managed by a quantum security service management and control platform, and the method further includes:

[0033] When the first computing device and the second computing device are started, their respective long-term public keys are registered with the quantum security service management and control platform; and

[0034] During the post-quantum security protocol negotiation, the corresponding long-term public key is obtained through the quantum security service management and control platform.

[0035] According to one embodiment, the API decoupling layer and the quantum security service layer are deployed on a computing device in one of the following ways: independent modules, independent processes, virtual machines, or containers.

[0036] In one scenario of the above implementation, the first computing device and the second computing device are: a blockchain node, a client terminal or a CA server.

[0037] According to the second aspect, the present invention also provides a quantum secure communication system for a blockchain network, wherein the blockchain network has a first computing device and a second computing device connected to each other, on which an API decoupling layer and a quantum secure service layer are deployed. The key library of the first quantum secure service layer deployed on the first computing device stores a first key pair generated based on a post-quantum encryption algorithm and a second key pair generated based on a traditional encryption algorithm. Among them:

[0038] The first computing device is configured to issue a signature request to the first quantum security service layer by calling a signature service interface of a first API decoupling layer deployed thereon, wherein the signature request includes a target transaction;

[0039] The first quantum security service layer is configured to, in response to the signature request, sign the target transaction using the first private key of the first key pair and the second private key of the second key pair, respectively, to obtain a first signature under a post-quantum encryption algorithm and a second signature under a traditional encryption algorithm;

[0040] The first computing device is further configured to send the target transaction and signature data including the first signature and the second signature to the second computing device;

[0041] The second computing device is configured to receive the target transaction and signature data, and enable the second quantum security service layer deployed thereon to obtain the first public key of the first key pair and the second public key of the second key pair by calling the certificate management interface of the second API decoupling layer deployed thereon;

[0042] The second computing device is further configured to call the signature verification service interface of the second API decoupling layer to send a signature verification request to the second quantum security service layer, wherein the signature verification request includes the signature data;

[0043] The second quantum security service layer is configured to, in response to the signature verification request, respectively use the first public key and the second public key to verify the first signature and the second signature in the signature data, and if there is a signature verification failure, notify the second computing device to reject the target transaction.

[0044] The present invention provides a quantum secure communication method and system for blockchain networks. Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0045] (1) In the solution provided by the present invention, a modular API decoupling layer and a quantum security service layer are designed. Through the modular design, quantum security upgrades are seamlessly implemented for the existing blockchain network. At the same time, a smooth transition dual-signature mechanism is provided to ensure the transaction security of the blockchain network before the popularization of post-quantum algorithms.

[0046] (2) The API decoupling layer proposed in the present invention can act as a middleware between the quantum security service layer and the computing devices in the blockchain network (e.g., blockchain nodes, client terminals, and CA servers), so that any computing device that needs to access the blockchain can seamlessly access the quantum security service. Moreover, the application of the API decoupling layer means that computing devices do not need to process complex quantum security algorithms, but instead call the required security functions through APIs, greatly reducing the complexity of technology integration. This allows existing blockchain networks to be quickly upgraded to cope with quantum threats without the need for large-scale modifications to existing architectures.

[0047] (3) Standardizing and unifying the API decoupling layer proposed in this invention can provide blockchain networks with greater flexibility and scalability, making it easier for blockchain networks to integrate with other systems or switch to different quantum security service providers in the future. This modular interface design also helps maintain and update the blockchain network. Any improvements to the quantum security service layer can be transparently passed to the computing devices in the blockchain network through the API decoupling layer without any modification to the computing devices themselves. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 A schematic diagram of a blockchain network architecture according to an exemplary embodiment;

[0049] Figure 2 A schematic diagram of a quantum secure communication system architecture for a blockchain network provided according to an embodiment of the present invention;

[0050] Figure 3 A flow chart of a method for establishing a secure communication tunnel between computing devices provided by an embodiment of the present invention;

[0051] Figure 4 A flowchart of a method for a dual signature mechanism applied in a blockchain network provided by an embodiment of the present invention;

[0052] Figure 5 A quantum secure communication system for a blockchain network is provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0053] As mentioned above, with the rapid development of quantum computing technology, the risk of traditional encryption algorithms relied on in blockchain networks being broken by quantum computers is increasing. In order to solve this technical problem, it is necessary to perform a quantum-safe seamless upgrade of the network without affecting the existing blockchain network, so that the traditional encryption algorithms in the existing blockchain network can smoothly transition to quantum encryption algorithms and achieve quantum-safe communication. Therefore, the inventors have proposed the following technical ideas:

[0054] On the one hand, a quantum security service layer is provided, which implements a series of post-quantum cryptographic algorithms and can be used for key management, key negotiation, signature and signature verification, etc. Introducing this logic layer in the existing blockchain network can enable the blockchain network to use quantum encryption algorithms to encrypt and sign communication protocols and transactions, making it capable of resisting the threat of future quantum computers.

[0055] On the other hand, an API decoupling layer is designed between the computing devices and the quantum security service layer in the blockchain network. As a middleware, it allows computing devices to call the quantum security services provided by the quantum security service layer through standardized APIs. This design allows the existing blockchain network to access quantum security services without having to worry about the complex implementation details of quantum security technology, and without large-scale transformation, which reduces the complexity and cost of technology upgrades.

[0056] On the other hand, a dual signature mechanism is introduced in the existing blockchain network. In transactions on the blockchain network, both traditional encryption algorithms and post-quantum encryption algorithms are used to sign and verify the transaction content. This not only ensures the compatibility of this technical solution with existing technologies, but also provides security in the quantum era. Moreover, this mechanism also provides a strategy for the blockchain network to smoothly transition to the post-quantum encryption algorithm, which allows the blockchain network to remain forward-looking and flexible in the evolving field of cryptography.

[0057] Finally, the quantum security service layer and the API decoupling layer are modularly designed and can be deployed as independent modules, processes, virtual machines or containers, so that they can be flexibly integrated into the existing blockchain network.

[0058] Based on the technical concept described above, one or more embodiments of the present invention propose a quantum secure communication method and system for a blockchain network. In order to enable those skilled in the art to better understand the solution of the present invention, the technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments.

[0059] The blockchain network is a distributed network built by multiple nodes. Any two nodes in it can achieve communication connection at the application layer through a peer-to-peer (P2P) network. Figure 1 As shown, Figure 1 A schematic diagram of a blockchain network architecture according to an exemplary embodiment is given. The blockchain network includes N nodes. Figure 1 Nodes 1 to 6 are shown in FIG. 1 ; in addition, there are computing devices ( Figure 1 The connection lines (dashed lines) between nodes schematically represent P2P connections, which may be TCP connections, etc., for transmitting data between nodes.

[0060] Each block in the blockchain stores data records (i.e. transactions) within a specified time period, and builds a secure and reliable chain through cryptography to form a tamper-proof, distributed ledger shared by all members. In other words, the blockchain is a ledger that records all historical transactions, with each node holding a copy. The nodes use a consensus algorithm to ensure that the ledgers of all nodes are consistent with each other. Each block in the blockchain is a page of the ledger, recording the transaction entries in a transaction batch. In this way, all transaction details are recorded in a public ledger that can be seen by any node. If you want to modify a recorded transaction, all nodes holding the ledger need to modify it at the same time so that all nodes accept the modification. In the blockchain network, this will be a huge workload that is almost impossible to complete. It is from this perspective that the blockchain has the characteristic of being tamper-proof.

[0061] The above is a brief introduction to the blockchain network. It is not difficult to understand that in a blockchain network, the immutability and communication security of the blockchain are based on the encryption algorithm used in the blockchain network. In the existing blockchain network, based on the traditional encryption algorithm, the nodes in the blockchain network establish a secure communication tunnel; also based on the traditional encryption algorithm, the blockchain network encrypts and protects the transactions between nodes. However, the traditional encryption algorithm used in the existing blockchain network does not have quantum security and there is a risk of being broken by quantum computers in polynomial time.

[0062] Therefore, it is necessary to upgrade the encryption algorithm of the existing blockchain network to make the blockchain network quantum secure. In one or more embodiments of this specification, a quantum secure communication method and system for a blockchain network are provided.

[0063] For example, Figure 2 A schematic diagram of a quantum secure communication system architecture for a blockchain network is provided according to an embodiment. Figure 2 In the blockchain network, there are blockchain nodes participating in the blockchain, client terminals that need to access the blockchain, and CA servers that issue certificates to computing devices connected to the blockchain. API decoupling layers and quantum security service layers are deployed on blockchain nodes, client terminals, and CA servers. For the sake of simplicity, in this specification, computing devices are used to illustrate the embodiments of the present invention. The computing devices include components in the blockchain network, such as blockchain nodes, client terminals, and CA servers. Among them:

[0064] Blockchain nodes are the basic units that make up the blockchain network. They can be any computing device that has a complete copy of the blockchain data. These nodes jointly maintain and update the blockchain database, process and verify transactions through a certain consensus mechanism, and ensure the decentralization of the network and the immutability of blockchain data. The characteristics of blockchain nodes have been described in the previous article and will not be repeated here. Blockchain nodes can be divided into different types, including but not limited to full nodes, miner nodes, and verification nodes, each of which has specific responsibilities. Blockchain nodes call the quantum security services provided by the quantum security service layer through the API decoupling layer to ensure the security of communication and transactions.

[0065] Client terminals usually refer to user-side computing devices connected to the blockchain, such as personal computers, smartphones, etc. Client terminals do not store complete blockchain data, but they can initiate transaction requests, query blockchain data, and interact with the blockchain. Client terminals call the quantum security services provided by the quantum security service layer through the API decoupling layer to ensure the security of communications and transactions.

[0066] A CA server refers to a certificate authority, which is a trusted third-party organization responsible for issuing, managing, and revoking digital certificates. In a blockchain network, a CA server is usually used to manage the authentication of computing devices by issuing digital certificates for the public keys of computing devices to confirm their identities. With the introduction of the quantum security service layer, the CA server is also responsible for issuing post-quantum certificates for post-quantum public keys to ensure the security and credibility of communications in the blockchain network.

[0067] The API decoupling layer is a middleware located between computing devices and the quantum security service layer. It provides a set of standardized API interfaces, and computing devices can access the quantum security services provided by the quantum security service layer by calling the API. The main function of the API decoupling layer is to abstract complex quantum security technologies so that computing devices can flexibly integrate quantum security functions without having to implement the complex technical details behind them. The introduction of the API decoupling layer can greatly reduce the difficulty of technology integration and provide a certain degree of flexibility for system upgrades and maintenance.

[0068] The interfaces provided by the API decoupling layer include:

[0069] Key negotiation interface: A computing device can request the generation of a new quantum-safe symmetric key by calling this interface.

[0070] Key acquisition interface: This interface allows computing devices to obtain the negotiated quantum-safe symmetric key. This interface can further differentiate the return parameters based on the identity of the caller. For example, if the caller is the initiator of key negotiation, the interface will return the key and key identifier (key ID), and when the caller is the responder of key negotiation, the interface will return the corresponding key based on the given key identifier.

[0071] Signature service interface: Computing devices can request post-quantum signatures by calling this interface; this interface also supports traditional algorithm signatures.

[0072] Signature verification service interface: The computing device calls this interface, submits the target transaction and the signature of the target transaction, and requests verification of the validity of the signature. It supports the verification of post-quantum signatures and traditional algorithm signatures.

[0073] Certificate management interface: This interface can provide a series of certificate-related services, including certificate acquisition, verification, revocation, and query and update of certificate status.

[0074] In addition, the API decoupling layer also provides other interfaces related to keys, such as key update interface, key revocation interface, key backup and recovery interface, and security audit interface. Since such interfaces are not referenced in the embodiments of the present invention, they will not be elaborated one by one in this specification. It should be noted that the above examples of interfaces do not serve as any limitation. In actual use, the interfaces can be renamed, added, merged or reduced according to different blockchains and actual business needs.

[0075] The quantum security services provided by the quantum security service layer use encryption algorithms that are resistant to quantum attacks, such as lattice-based cryptography algorithms, which can enhance the security of blockchain networks. The quantum security service layer provides quantum security services such as key negotiation, identity authentication, signature and verification, with the aim of protecting blockchain networks from potential threats from future quantum computer attacks. The quantum security service layer usually runs as an independent service, and the quantum security services it provides can be called by computing devices through the API decoupling layer.

[0076] The quantum security services provided by the quantum security service layer include:

[0077] Key negotiation: A quantum-secure symmetric key is negotiated between the quantum-secure service layers of any two computing devices through a quantum-secure key negotiation protocol (e.g., the Noise protocol based on the KEM mechanism using a dual public-private key pair scheme). This symmetric key can be used as a PSK (Pre-Shared Key) and provided to a security protocol (e.g., the TLS protocol) to establish quantum-secure communication between computing devices.

[0078] Key management: Manage quantum-safe key pairs and respond to requests for keys sent through API calls.

[0079] Quantum-safe signature verification: Provides post-quantum signature algorithms, such as lattice-based signature algorithms, for signing and verifying transactions, ensuring the unforgeability and non-repudiation of transactions in blockchain networks.

[0080] Certificate management: Provides a series of certificate-related services, including certificate acquisition, verification, revocation, and query and update of certificate status. It is not difficult to understand that the storage, management, and use of certificates may be different depending on the architecture and design of the blockchain. In one or more implementations of this specification, the example of certificates being uniformly stored in the quantum security service layer for management will be used for explanation. In other implementations, different certificate management methods can also be adopted to store certificates in other secure storage devices according to the specific needs of the blockchain.

[0081] In some embodiments, the API decoupling layer and the quantum security service layer are deployed on a computing device in one of the following ways: independent modules, independent processes, virtual machines, or containers.

[0082] The above is Figure 2 The following is an introduction to the components included in the blockchain network. It can be understood that Figure 2 The blockchain network system architecture and the computing devices included therein shown in the specification will be adjusted accordingly according to different types of blockchains. For example, in a permissionless blockchain (public blockchain, such as Ethereum), the computing device accessing the blockchain does not rely on traditional digital certificates for identity authentication. In such a blockchain network, there is no need to set up a CA server to issue and authorize certificates. In this specification, the embodiment of the present invention will be described by taking the permissioned blockchain Hyperledger Fabric as an example.

[0083] In summary, in order to ensure that communications and transactions in the blockchain network are quantum secure. On the one hand, it is necessary to upgrade the existing blockchain network to quantum security and replace the traditional encryption algorithm used in the network with a quantum encryption algorithm. On the other hand, in order to enable the encryption algorithm in the existing blockchain network to smoothly transition to the quantum encryption algorithm, the embodiment of the present invention also introduces a dual signature mechanism in the transaction process, which uses both the signature and verification under the traditional encryption algorithm and the signature and verification under the post-quantum encryption algorithm. It not only ensures compatibility with the existing technology, but also provides security in the quantum era. In combination with the accompanying drawings and embodiments, the following will first describe the method for establishing a quantum secure communication tunnel, and then describe an exemplary embodiment of the dual signature mechanism used in the transaction process.

[0084] In one embodiment, a blockchain network includes a first computing device and a second computing device with which a secure communication tunnel needs to be established. Accordingly, a first API decoupling layer and a first quantum security service layer are deployed on the first computing device; and a second API decoupling layer and a second quantum security service layer are deployed on the second computing device. Figure 3 The following is a flow chart of a method for establishing a secure communication tunnel between computing devices according to this embodiment. Figure 3 , the method specifically comprises:

[0085] S301: Before the first computing device sends the target transaction to the second computing device, the first computing device calls the key acquisition interface of the first API decoupling layer to obtain a pre-negotiated target symmetric key package, which includes a target symmetric key and a target symmetric key identifier, and the first computing device sends the target symmetric key identifier to the second computing device.

[0086] In a specific scenario of this embodiment, when a computing device in a blockchain network is started, it can pre-negotiate a key with other computing devices, and negotiate with any computing device in the network to obtain a corresponding symmetric key (included in the target symmetric key package). The quantum security service layer stores the obtained multiple sets of symmetric keys in advance, and the computing device retrieves them for use when a secure communication tunnel needs to be established. In this scenario, the target symmetric key package is obtained by the following steps:

[0087] The first computing device calls the key negotiation interface of the first API decoupling layer, and negotiates with the second quantum security service layer through the first quantum security service layer based on the post-quantum security protocol to obtain a quantum-secure target symmetric key package.

[0088] In one example, the post-quantum security protocol is a Noise protocol based on a KEM mechanism (Key Encapsulation Mechanism) using a dual public-private key pair scheme. In other examples, other key agreement protocols that support post-quantum algorithms may also be used, and this specification does not specifically limit this.

[0089] In the above example, since multiple computing devices in the blockchain network need to be interconnected and use the KEM algorithm to establish a quantum-safe tunnel, if KEM long-term public-private key pairs are involved, public keys need to be manually exchanged between computing devices. In order to be more automated, a quantum-safe service management and control platform is deployed in the blockchain network (in Figure 2 (not shown in the figure), through this platform, the long-term public keys in the network are centrally managed and long-term KEM public keys are distributed to computing devices.

[0090] In a possible implementation, when each computing device in the blockchain network is started, the quantum security service layer on it registers the computing device with the quantum security service management and control platform and uploads its own long-term KEM public key. The quantum security service management and control platform is responsible for managing all long-term KEM public keys and distributing the long-term KEM public key of any computing device to other computing devices in the blockchain network.

[0091] S303: The second computing device receives the target symmetric key identifier, and accordingly calls the key acquisition interface of the second API decoupling layer to obtain the target symmetric key.

[0092] S305: The first computing device and the second computing device use the target symmetric key as a pre-shared key and communicate based on a security protocol.

[0093] In a specific implementation, the security protocol is the TLS protocol, and the above embodiment scenario can be exemplified as follows:

[0094] Computing device A in the blockchain network calls the key negotiation interface of the API decoupling layer deployed on the computing device, so that the quantum security service layer deployed on it negotiates with the quantum security service layer deployed on the peer computing device (computing device B) that needs to establish a secure communication tunnel, and obtains and stores the quantum secure target symmetric key package.

[0095] When it is necessary to start communication with computing device B, computing device A calls the key acquisition interface of its API decoupling layer, and as the communication initiator, it will obtain the target symmetric key package corresponding to computing device B. Then computing device A passes the target symmetric key and target symmetric key identifier contained therein as PSK and PSK_ID to the TLS protocol.

[0096] During the handshake process based on the TLS protocol, computing device A and computing device B transmit the target symmetric key identifier (ie, PSK_ID).

[0097] After computing device B receives the PSK_ID in the handshake message, it can call the key acquisition interface of the API decoupling layer deployed on it, pass in the PSK_ID, and obtain the target symmetric key as the PSK.

[0098] At this point, computing device A and computing device B have both obtained the same PSK during the handshake process of the TLS protocol, and can be used for subsequent identity authentication or session key security enhancement of the TLS protocol. In this way, the quantum security service layer provides an out-of-band quantum-secure pre-shared key for the TLS protocol between computing devices in the blockchain network, thereby enhancing the security of encrypted transmission in the network. Since the symmetric key negotiated by the quantum service security layer is quantum-secure, the TLS protocol that uses this key as the PSK and the secure communication tunnel established based on the TLS protocol are also quantum-secure. Using this method, except for PSK and PSK_ID, the TLS protocol itself does not make any other changes, which greatly reduces the complexity of quantum security upgrades of security protocols in blockchain networks.

[0099] It can be understood that the security protocol used in the above-mentioned transmission link is only an example of an exemplary scenario. In other specific scenarios, quantum secure transmission links can also be built based on different protocols that support quantum security, such as HTTPS and SSL, so that the communication tunnel in the blockchain network has quantum security. In this manual, security protocols are not given as examples one by one.

[0100] Through the above steps, a quantum-secure communication tunnel is established in the blockchain network. Next, the dual signature mechanism used in the transaction process proposed in the embodiment of the present invention will be described in combination with the accompanying drawings and embodiments.

[0101] In one embodiment, a blockchain network has a first computing device and a second computing device connected to each other, on which an API decoupling layer and a quantum security service layer are deployed. For the convenience of description, the first computing device is named as the first API decoupling layer and the first quantum security service layer, and correspondingly, the second computing device is named as the second API decoupling layer and the second quantum security service layer.

[0102] When the first computing device is started, the first quantum security service layer generates a key pair for it, including: a post-quantum key pair (first key pair) generated based on a post-quantum encryption algorithm, and a traditional encryption algorithm key pair (second key pair) generated based on a traditional encryption algorithm. The first key pair and the second key pair are stored in a key library of the first quantum security service layer.

[0103] In one implementation of this embodiment, when the blockchain network is a permissioned blockchain network (for example, a Hyperledger Fabric network), the blockchain network also includes a certificate authority CA server, which manages the public key in the key pair through a certificate.

[0104] Specifically, the first computing device calls the certificate management interface of the first API decoupling layer, and applies for a certificate from the CA server through the first quantum security service layer, where the certificate application includes the first public key and the second public key.

[0105] The first quantum security service layer stores a first certificate generated by the CA server based on the first public key and a second certificate generated based on the second public key.

[0106] In another implementation of this embodiment, when the blockchain network is a permissionless blockchain network (e.g., Ethereum), the first public key in the first key pair and the second public key in the second key pair will be registered on the blockchain.

[0107] Specifically, the first computing device calls the certificate management interface of the first API decoupling layer, and registers a public key with the blockchain in the blockchain network through the first quantum security service layer, where the public key registration includes the first public key and the second public key.

[0108] So far, in this embodiment, the key pair of the computing device in the blockchain network has been securely stored, and when the first computing device initiates a transaction, the key pair can be used to double-sign and verify the transaction. Next, the double signature mechanism will be introduced in detail.

[0109] Figure 4 The method flow of the dual signature mechanism applied in the blockchain network according to this embodiment is shown. Figure 4 , the method specifically comprises:

[0110] S401: The first computing device sends a signature request to the first quantum security service layer by calling the signature service interface of the first API decoupling layer deployed thereon, where the signature request includes a target transaction.

[0111] S403: In response to the signature request, the first quantum security service layer uses the first private key of the first key pair and the second private key of the second key pair to sign the target transaction, respectively, to obtain a first signature under a post-quantum encryption algorithm and a second signature under a traditional encryption algorithm.

[0112] S405: The first computing device sends the target transaction and signature data including the first signature and the second signature to the second computing device.

[0113] The first signature and the second signature obtained in this step are independent of each other, and each signature can independently verify the integrity of the target transaction and the identity of the initiator of the target transaction. The signature data will be sent to the second computing device together with the target transaction, or attached to the target transaction and sent to the second computing device.

[0114] S407: The second computing device receives the target transaction and signature data, and by calling the certificate management interface of the second API decoupling layer deployed thereon, enables the second quantum security service layer deployed thereon to obtain the first public key of the first key pair and the second public key of the second key pair.

[0115] According to one implementation, when the blockchain network is a permissioned blockchain network (e.g., a Hyperledger Fabric network), the second quantum security service layer obtains a public key through a licensed certificate in the network.

[0116] Specifically, the second quantum security service layer obtains the first certificate and the second certificate from the first quantum security service layer. The second computing device calls the certificate verification interface of the second API decoupling layer, and performs certificate verification on the first certificate and the second certificate through the second quantum security service layer. If the certificate verification is successful, the second quantum security service layer extracts the public key in the certificate to obtain the first public key and the second public key.

[0117] According to other implementations, when the blockchain network is a permissionless blockchain network (e.g., Ethereum), the second quantum security service layer obtains the first public key and the second public key from the database of the blockchain. In this implementation, the entire system will rely on the blockchain itself as the basis of trust, using records on the blockchain to verify and manage public keys, thereby ensuring the security of transactions and communications.

[0118] S409: The second computing device calls the signature verification service interface of the second API decoupling layer and sends a signature verification request to the second quantum security service layer, where the signature verification request includes the signature data.

[0119] S411: In response to the signature verification request, the second quantum security service layer uses the first public key and the second public key to verify the first signature and the second signature in the signature data respectively, and if there is a signature verification failure, notifies the second computing device to reject the target transaction.

[0120] In this embodiment, the quantum security service layer verifies both the traditional encryption algorithm signature and the post-quantum encryption algorithm signature. It is understandable that the scope of the verification can be adjusted according to specific business needs. In other embodiments, if the traditional encryption algorithm is applied in the blockchain network, then only the traditional encryption algorithm signature can be verified. In some embodiments, if the post-quantum encryption algorithm has been applied in the blockchain network, then only the post-quantum encryption algorithm signature can be verified. Regardless of which verification method is used, the computing device in the blockchain network will not be modified, because in this embodiment, the quantum security service layer that specifically implements the verification method has been decoupled from the computing device by introducing an API decoupling layer. The verification service interface provided by the API decoupling layer is a standardized interface. For the computing device, the implementation logic behind the verification service is transparent.

[0121] In another embodiment of the present invention, a quantum secure communication system for a blockchain network is provided, which can be deployed on any device or platform with computing and processing capabilities. The blockchain network has a first computing device and a second computing device connected to each other, on which an API decoupling layer and a quantum secure service layer are deployed; the key library of the first quantum secure service layer deployed on the first computing device stores a first key pair generated based on a post-quantum encryption algorithm and a second key pair generated based on a traditional encryption algorithm.

[0122] Figure 5 A quantum secure communication system for a blockchain network provided according to an embodiment of the present invention is shown. Figure 5 , in the system 500:

[0123] The first computing device 501 is configured to issue a signature request to the first quantum security service layer by calling the signature service interface of the first API decoupling layer deployed thereon, wherein the signature request includes a target transaction.

[0124] The first quantum security service layer 502 is configured to, in response to the signature request, sign the target transaction using the first private key of the first key pair and the second private key of the second key pair, respectively, to obtain a first signature under a post-quantum encryption algorithm and a second signature under a traditional encryption algorithm.

[0125] The first computing device 501 is further configured to send the target transaction and signature data including the first signature and the second signature to the second computing device.

[0126] The second computing device 503 is configured to receive the target transaction and signature data, and by calling the certificate management interface of the second API decoupling layer deployed thereon, enable the second quantum security service layer deployed thereon to obtain the first public key of the first key pair and the second public key of the second key pair.

[0127] The second computing device 503 is further configured to call the signature verification service interface of the second API decoupling layer and send a signature verification request to the second quantum security service layer, where the signature verification request includes the signature data.

[0128] The second quantum security service layer 504 is configured to, in response to the signature verification request, respectively use the first public key and the second public key to verify the first signature and the second signature in the signature data, and if there is a signature verification failure, notify the second computing device to reject the target transaction.

[0129] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. A quantum secure communication method for a blockchain network, wherein the blockchain network has a first computing device and a second computing device connected to each other, on which an API decoupling layer and a quantum secure service layer are deployed; A key library of a first quantum security service layer deployed on the first computing device stores a first key pair generated based on a post-quantum encryption algorithm and a second key pair generated based on a traditional encryption algorithm; the method comprises: The first computing device issues a signature request to the first quantum security service layer by calling the signature service interface of the first API decoupling layer deployed thereon, wherein the signature request includes a target transaction; In response to the signature request, the first quantum security service layer uses the first private key of the first key pair and the second private key of the second key pair to sign the target transaction, respectively, to obtain a first signature under a post-quantum encryption algorithm and a second signature under a traditional encryption algorithm; The first computing device sends the target transaction and signature data including the first signature and the second signature to the second computing device; The second computing device receives the target transaction and signature data, and enables the second quantum security service layer deployed thereon to obtain the first public key of the first key pair and the second public key of the second key pair by calling the certificate management interface of the second API decoupling layer deployed thereon; The second computing device calls the signature verification service interface of the second API decoupling layer and sends a signature verification request to the second quantum security service layer, where the signature verification request includes the signature data; In response to the signature verification request, the second quantum security service layer uses the first public key and the second public key respectively to verify the first signature and the second signature in the signature data, and if there is a signature verification failure, notifies the second computing device to reject the target transaction.

2. The method according to claim 1, wherein: The blockchain network is a Hyperledger Fabric network; the method further comprises: When the first computing device is started, the certificate management interface of the first API decoupling layer is called, and a certificate application is made to a certificate authority CA server through the first quantum security service layer, where the certificate application includes the first public key and the second public key; The first quantum security service layer stores a first certificate generated by the CA server based on the first public key and a second certificate generated based on the second public key; And, the second quantum security service layer obtains the first public key of the first key pair and the second public key of the second key pair, specifically including: The second quantum security service layer obtains the first certificate and the second certificate from the first quantum security service layer; The second computing device calls the certificate verification interface of the second API decoupling layer, and performs certificate verification on the first certificate and the second certificate through the second quantum security service layer; If the certificate verification succeeds, the second quantum security service layer extracts the public key in the certificate to obtain the first public key and the second public key.

3. The method according to claim 1, wherein: The blockchain network is a permissionless blockchain network; the method further comprises: When the first computing device is started, the certificate management interface of the first API decoupling layer is called, and a public key is registered with the blockchain in the blockchain network through the first quantum security service layer, where the public key registration includes the first public key and the second public key; And, the second quantum security service layer obtains the first public key of the first key pair and the second public key of the second key pair, specifically including: The second quantum security service layer obtains the first public key and the second public key from the blockchain.

4. The method according to claim 1, further comprising: Before the first computing device sends the target transaction to the second computing device, the first computing device calls the key acquisition interface of the first API decoupling layer to obtain a pre-negotiated target symmetric key package, which includes a target symmetric key and a target symmetric key identifier, and the first computing device sends the target symmetric key identifier to the second computing device; The second computing device receives the target symmetric key identifier, and accordingly calls the key acquisition interface of the second API decoupling layer to obtain the target symmetric key; The first computing device and the second computing device communicate based on a security protocol using the target symmetric key as a pre-shared key.

5. The method according to claim 4, wherein: The target symmetric key package is obtained by the following steps: The first computing device calls the key negotiation interface of the first API decoupling layer, and negotiates with the second quantum security service layer through the first quantum security service layer based on the post-quantum security protocol to obtain a quantum-secure target symmetric key package.

6. The method according to claim 5, wherein: The security protocol is the TLS protocol; the post-quantum security protocol is the Noise protocol based on the KEM mechanism using a dual public-private key pair solution.

7. The method according to claim 6, wherein: The long-term public key used in the KEM mechanism is managed by the quantum security service management and control platform, and the method further includes: When the first computing device and the second computing device are started, their respective long-term public keys are registered with the quantum security service management and control platform; and During the post-quantum security protocol negotiation, the corresponding long-term public key is obtained through the quantum security service management and control platform.

8. The method according to claim 1, wherein: The API decoupling layer and quantum security service layer are deployed on computing devices in one of the following ways: independent modules, independent processes, virtual machines, or containers.

9. According to the method according to any one of claims 1-8, the first computing device and the second computing device are: a blockchain node, a client terminal or a CA server.

10. A quantum secure communication system for a blockchain network, wherein the blockchain network has a first computing device and a second computing device connected to each other, on which an API decoupling layer and a quantum secure service layer are deployed; The key library of the first quantum security service layer deployed on the first computing device stores a first key pair generated based on a post-quantum encryption algorithm and a second key pair generated based on a traditional encryption algorithm; wherein: The first computing device is configured to issue a signature request to the first quantum security service layer by calling a signature service interface of a first API decoupling layer deployed thereon, wherein the signature request includes a target transaction; The first quantum security service layer is configured to, in response to the signature request, sign the target transaction using the first private key of the first key pair and the second private key of the second key pair, respectively, to obtain a first signature under a post-quantum encryption algorithm and a second signature under a traditional encryption algorithm; The first computing device is further configured to send the target transaction and signature data including the first signature and the second signature to the second computing device; The second computing device is configured to receive the target transaction and signature data, and enable the second quantum security service layer deployed thereon to obtain the first public key of the first key pair and the second public key of the second key pair by calling the certificate management interface of the second API decoupling layer deployed thereon; The second computing device is further configured to call the signature verification service interface of the second API decoupling layer to send a signature verification request to the second quantum security service layer, wherein the signature verification request includes the signature data; The second quantum security service layer is configured to, in response to the signature verification request, respectively use the first public key and the second public key to verify the first signature and the second signature in the signature data, and if there is a signature verification failure, notify the second computing device to reject the target transaction.

Images